Vite transformMiddleware File Read

The vulnerability of the transformMiddleware function in the @fs mechanism of the local development server for Vite applications is related to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files by...

Incorrect Authorization

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Incorrect Authorization due to missing checks in transformMiddleware which ignore certain query parameters. An attacker can access unauthorized files by including a ?raw?? ...